github.com/go-redis/redis
Submitted 8/4/2026, 1:45:34 AM · Status: ok
Risk grade
F
89 / 100
Findings
827
0 critical11 high25 medium5 low786 info0 on CISA KEV0ATT&CK
Showing 827 of 827 findings
Findings
- A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.grypeCVE-2026-56852EPSS 0.4%
- Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.grypeCVE-2026-46600EPSS 0.3%
- The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in progra…grypeCVE-2026-39821EPSS 0.7%
- A norm.Iter can enter an infinite loop when handling input containing ...A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.trivyCVE-2026-56852
- A norm.Iter can enter an infinite loop when handling input containing ...A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.trivyCVE-2026-56852
- golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypassParsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.trivyCVE-2026-27136
- golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypassParsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.trivyCVE-2026-27136
- golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site ScriptingParsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.trivyCVE-2026-25681
- golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site ScriptingParsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.trivyCVE-2026-25681
- golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processingThe ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in program…trivyCVE-2026-39821
- golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processingThe ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in program…trivyCVE-2026-39821
This report is public.